In the ongoing Apple CSAM saga, Irreal has mostly been concerned with Apple\u2019s betrayal of their promise to protect their users\u2019 privacy but there\u2019s also the issue the long term security consequences of Apple\u2019s decision. We\u2019ll take a look at the security of Apple\u2019s plan in a later post. This is a sort of meta-post on the dangers of introducing backdoors.<\/p>\n
Before we begin, it\u2019s worth noting that Apple has delayed the rollout of their clientside CSAM scanning<\/a>. The optimistic reading of their words is that, \u201cYes we know we screwed up and this is our way of abandoning the program without admitting we were wrong.\u201d If they\u2019re still not convinced, here are some reasons why it\u2019s a really<\/i> bad idea.<\/p>\n In the early 2000\u2019s, the NSA had a clever plan. They devised a random number generator (DUAL_EC) that would allow them access to encrypted messages and pressured industry to adopt it. Almost immediately, security researchers pointed out the RNG had serious vulnerabilities but the NSA and its apologists pressed on. They claimed that even if that was true, only the NSA had the key to exploit the vulnerability so all was well. Unfortunately, the NSA had been too clever by half because hackers\u2014unidentified to this day\u2014managed to rekey Juniper Networks implementation and gained access to sensitive government communications for three years. Irreal has written about DUAL_EC before [1<\/a>, 2<\/a>]. Matt Green has an excellent Twitter thread (unrolled here<\/a>) that recounts a brief history of the disaster.<\/p>\n This is the NSA, whose raison d\u2019\u00eatre<\/i> is devising secure communication protocols, trying to introduce a secure backdoor and failing. What reason is there to believe that Apple would do any better? Indeed, security researchers have already pointed out problems. Apple insists that there\u2019s no backdoor and, trust us, everything is under control. If Apple persists, they and the rest of us will find out just how naive that view is.<\/p>\n","protected":false},"excerpt":{"rendered":" In the ongoing Apple CSAM saga, Irreal has mostly been concerned with Apple\u2019s betrayal of their promise to protect their users\u2019 privacy but there\u2019s also the issue the long term security consequences of Apple\u2019s decision. We\u2019ll take a look at … Continue reading